Cyber Resilience

CVE-2026-10018

MediumUpdated

Published: 28 May 2026

Published
28 May 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score 0.0019 8.9th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-10018 is a medium-severity External Control of Assumed-Immutable Web Parameter (CWE-472) vulnerability in Google Chrome. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 8.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CWE(s)
CWE-472

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

CVE enables drive-by info disclosure from browser process memory via malicious HTML page (T1189) and directly facilitates access to sensitive local/process data (T1005).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-10019Same product: Apple Macos
CVE-2026-5912Same product: Apple Macos
CVE-2026-10965Same product: Apple Macos
CVE-2026-5274Same product: Apple Macos
CVE-2026-7896Same product: Apple Macos
CVE-2026-11211Same product: Apple Macos
CVE-2026-9968Same product: Apple Macos
CVE-2025-10891Same product: Apple Macos
CVE-2026-10015Same product: Apple Macos
CVE-2026-5859Same product: Apple Macos

Affected Assets

google
chrome
≤ 148.0.7778.216 · ≤ 148.0.7778.215

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References